Oracle Hyperion Calculation Manager CVE-2026-70683

Exploitation requires that a person other than the attacker - presumably an authenticated Hyperion user - interact with attacker-controlled content (e.g., click a link or load a page) while their session with Oracle Hyperion Calculation Manager 11.2.25.0.000 is active. The attacker requires no authentication credentials (PR:N per CVSS). The application must be reachable over the network via HTTP. What limits exploitation: the mandatory human interaction step (UI:R) prevents fully automated or wormable attacks; the attacker cannot exploit this unilaterally without a social engineering vector to reach an active Hyperion session holder. No special non-default configuration is identified as required - the vulnerability appears to affect the default installation of the stated version.

The CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N reflects a constrained but network-reachable attack. The integrity-only impact (I:L) and absence of confidentiality or availability harm limit the blast radius. The mandatory user interaction requirement (UI:R) is a meaningful barrier: exploitation cannot be automated without a social engineering or watering-hole component. No EPSS score was provided in the input, so exploitation probability cannot be quantified numerically. There is no CISA KEV entry and no public exploit code identified, making opportunistic mass exploitation unlikely at this time. The 'Authentication Bypass' tag elevates concern slightly - if the attack effectively lets an unauthenticated party perform data writes as an authenticated user, the integrity impact could be more consequential than I:L implies for sensitive financial data. Overall, this is a real but lower-priority vulnerability unless the Hyperion deployment handles high-value financial data where even limited unauthorized writes carry regulatory or audit risk.

An attacker identifies a target organization running Oracle Hyperion Calculation Manager 11.2.25.0.000 exposed over HTTP and crafts a malicious URL or hidden form targeting the vulnerable Security component. The attacker delivers this via phishing email or a compromised webpage to an authenticated Hyperion user; when the victim interacts, their browser submits the forged HTTP request on their behalf, resulting in unauthorized modification or deletion of Calculation Manager data. No public exploit code exists at time of analysis, so this scenario currently requires targeted social engineering rather than automated tooling.